Uncertainty-based rejection (confidence thresholding) provides negligible improvement against behaviorally overlapping unknown services. In I2P, XGBoost rejection recovery is +0.0% Macro-F1; FreeNet known-service mean confidence is 97.75% vs. unknown-service 97.95%, making threshold-based separation impossible. Only Tor exhibits partial confidence separation (known 81.22% vs. unknown 67.66%), enabling XGB recovery of +8.5%.

Closed-world evaluation substantially overestimates deployment robustness for darknet traffic classifiers. XGBoost Macro-F1 drops from 88.8% to 46.1% in I2P and Random Forest from 87.4% to 45.7% when unknown services are introduced at inference time under leave-one-service-out evaluation. FreeNet shows the highest closed-world inflation, with RF reaching 96.0% closed-world vs. 61.9% under open-world forced classification.

§IV-A, Table II evaluation

Macro-F1 degrades more severely than Accuracy under open-world evaluation, revealing that classification failures disproportionately concentrate on behaviorally overlapping minority service classes. High Accuracy values in FreeNet (unknown services absorbed at 97.95% confidence) do not indicate successful detection of unseen services. Conventional single-metric reporting thus conceals the most operationally relevant failure modes.

§IV-B, Fig. 3 evaluation

Unknown darknet service traffic is not randomly misclassified but is absorbed into semantically related known services with high confidence. FreeNet video traffic is classified as browsing with an 88.1% assignment rate at 97.95% mean confidence; I2P P2P traffic is absorbed into FTP-related behavior with an 83.4% assignment rate at 92.93% mean confidence. Behavioral similarity, not classifier uncertainty, drives open-world failure.

§IV-C, Table III detection

Stage 1 of the detection pipeline uses a lightweight heuristic: restrict analysis to IP addresses in "VPS-dense ASNs," which censors already target for resource-intensive inspection of fully-encrypted traffic. This pre-filter dramatically reduces the search space before applying the more expensive dual-role behavioral analysis. The evaluation was conducted without Stages 1 and 3 due to dataset limitations, meaning the reported 23% recall and 0.18% FPR are conservative lower bounds on the full pipeline's performance.

2026-almutairi-server §2.1, §2.2, §3.4 fully-encrypted-detectdpiml-classifier

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

2026-cui-chameleon-robust-defense §V-B, Table II, Abstract website-fingerprintml-classifier

Defense-aware autoencoder (DAAE) attacks can recover website fingerprinting accuracy against defenses that successfully resist adversarial training. On the GTT23 dataset, DAAE-based DF attacks achieve over 90% accuracy against RegulaTor and over 80% against Palette and Adaptive Tamaraw, despite those defenses reducing unaugmented DF attack accuracy from 93.2% to 2–35%. Adversarial training robustness and DAAE robustness are distinct and non-interchangeable properties.

2026-cui-chameleon-robust-defense §I, Figure 1 website-fingerprintml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape